ELECTRONIC SYSTEM OPERATING UNDER IRRADIATION, PROCESS FOR 
DESIGNING SUCH A SYSTEM AND APPLICATION THEREOF TO THE CONTROL 

OF A MOBILE ROBOT 



DESCRIPTION 



TECHNICAL FIELD 



The present invention relates to an electronic system operating under 
10 irradiation, particularly X or gamma radiation, a process for 

designing such a system intended to make said system function under 
irradiation whilst incorporating "vulnerable" components, i.e. 
intrinsically unfit to operate under said irradiation, and the appli- 
cation of said process to the control of a mobile robot. 

15 

Although the legal unit of measurement for radiation doses integrated 
by components is the Gray (Gy) , the experts and most reference docu- 
ments express this magnitude in the old unit, i.e. the Rad. Herein- 
after use will consequently be made of said second unit. It is 
20 pointed out that 100 Rad = 1 Gy. 

The term "vulnerable" circuits is understood to mean electronic cir- 
cuits only able to understand one or a few hundred kRad, typically 
in the form of gamma or neutron radiation, such as are encountered in 
25 nuclear engineering. In general, such circuits have a very large 

scale integration (VLSI) and are based on CMOS technology, although 
these features are not limitative. 

These "vulnerable" circuits are the only ones able to implement very 
30 complex functions. Examples are microcontrollers, digital signal 

processors, application specific integrated circuits (A6ICs) or bulk 
memories. They are particularly appropriate for the implementation 
of control systems carried by high technology remote manipulators 
or on mobile robots. 

35 

Thus, the invention is mainly directed at the design of control 
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systems for a nuclear environment, which are at present the highest 
performance electronic systems working in such an environment. 
Consequently they are used as the example for the description of a 
preferred embodiment. However, it does not pass beyond the scope of 
the invention to apply same * to any other electronic system, provided 
that its complexity makes it advantageous to use components which are 
"vulnerable" to ambient irradiation. 

The term "control system" is not considered here in the very res- 
tricted sense often used in nuclear engineering, notably due to the 
very rudimentary performance characteristics authorized in the prior 
art and whereof a few examples will be given hereinafter. Sub- 
sequently the term control system is used in a broader sense in that 
its function is to collect informations on the system to be con- 
trolled, process them if necessary (e.g. by digital filtering/non- 
linearity correction), apply thereto one or more digital control laws 
which can include autonomous operating modes able to take decisions, 
manage the controls of power amplifiers associated with actuators, 
ensure safety functions and, in the case of a partial failure, manage 
degraded operating modes. Such a control may also be able to comm- 
unicate with an information transmission device, as a function of the 
possibilities of various working configurations (multiplexing, micro- 
wave transmission or any other means). 

PRIOR ART 



In the prior art, electronic systems operating under such an irradi- 
ation and incorporating such vulnerable components are essentially 
control systems for mobile robots or teleoperated equipment or 
machines. They can be subdivided into two categories, as a function 
of the radiation dose which they are able to withstand. 

A first category includes control systems which can correspond to the 
above definition, but which in practice are unable to withstand more 
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than a few kRad and in exceptional cases a few dozen kRad. 

Reference can e.g. be made to the Andros mobile intervention robot 
designed by Remotech, USA. The electronics carried consist of a 
5 standard controller constituted by a microcontroller card and vari- 
ators available in commerce. The controls are transmitted by an 
umbilical cord. The control system is conventional, close to indus- 
trial-type controls, but its radiation resistance or hardness does 
not exceed 1 to 10 kRad. 

10 

A second category covers very simplified control systems unable to 
comply with the above definition, but able to withstand several dozen 
kRad or even several hundred kRad when containing virtually no elec- 
tronics and when their control is displaced to the end of a wire-to- 
15 wire link. 

An example is constituted by the Oscar mobile intervention robot for 
which all the control signals are transmitted wire-to-wire by an 
umbilical cord having a large diameter compared with the robot 
20 dimensions and whose length is necessarily limited. 

Another example is constituted by the assisted RD 500 remote manip- 
ulator used on the La Hague site in the 1990* s. All the control 
signals are transmitted wire-to-wire by an umbilical cord and the 
25 actual control is displaced into a non-irradiated area. 

More generally, this second category of highly simplified control 
systems is solely directed at: 

acquiring one or several measurements, 
30 - optionally processing them in rudimentary manner by simple analog 

filtering (of the first order) or in the best possible case by 

digitization under 8 bits with long conversion times (exceeding 

10 jis), 

transmitting said measurement or measurements in accordance with a 
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fixed sequential protocol, when not directly wire-to-wire, which 
then raises the problem of an umbilical cord which is prejudicial 
as a result of its diameter, weight or its very existence (it 
makes it impossible to pass through an air lock), 
5 - supply directives to power amplifiers which do not really belong 
to the control system. 

The systems of said second category cannot implement high performance, 
evolved functions and cannot be autonomous and reliable, reliability 
10 assuming the existence of degraded modes or redundancies, as well as 
the capacity to operate autonomously. 

At present there is no solution making it possible for such a control 
system to operate under irradiation. The proof is supplied by docu- 

15 ment [3], which mentions the project concerning a mobile. robot 
intended to intervene on the Chernobyl site. The specification 
required a resistance or hardness to 1 MRad and the solution adopted 
corresponds to said second above category in its most rudimentary 
form, i.e. complete absence of carried electronics, all the elec- 

20 tronics being effected wire-to-wire by an umbilical cord. 

The response of the expert is described in document [4], chapter 4, 
devoted to the design strategy. It only offers four solutions: 
A - the shielding of components or equipment, 
25 B - the choice of the location of the equipment, 

C - the use of equipment able to withstand radiation and already 

commercially available, 
D - the development of equipment able to withstand radiation. 

30 In practice, it is usually limited to shielding or an offset location 
of the electronics. Each of the solutions will be examined below. 



35 
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Solution A, regarding shielding: 

Certain components have a box or case designed to resist ionizing 
radiation. However, it is a lightweight shield against single event 

5 upsets (SEUs) encountered by satellites, which are accidental colli- 
sions with extremely high energy particles, which can give rise to 
the local destruction of a microcomponent . They only have a very 
limited effectiveness against gamma radiation even when reinforced by 
a supplementary metal screen, because the cumulative gamma radiation 

10 dose which can be withstood by a satellite is relatively low (approx- 
imately 100 kRad for its entire life) and does not constitute an 
aim for the designer. The expert knows that despite the common 
reference made to "ionizing radiation", it is in fact a different 
problem to those encountered in the nuclear industry. 

15 

In the nuclear industry, the shield against ionizing radiation is 
constituted by a thick, heavy metal covering (e.g. of lead or Denal 
for gamma radiation), because the attenuation provided by said shield 
is dependent on the atomic mass of the material. Attenuation curves 

20 show that the thickness must exceed several centimetres to ensure 
that the shield has any significance and this thickness increases 
very rapidly on increasing the admissible radiation dose. Thus, for 
lead shielding the controls of a gantry operating on a French indus- 
trial site (managed by an industrial controller), it was necessary 

25 to use an approximately one lead tonne shield, which required a 

costly overdimensioning of the gantry structure. This shield was 
designed to enable the controls to withstand 1 MRad. In addition, it 
was necessary to replace the controls every year, making it necessary 
to immobile the installation, which was so expensive that the oper- 

30 ator decided to abandon this solution and install a control displaced 
into the non-irradiated area and with a wire-to-wire link. 

This shielding solution, which appears too weighty for a heavy equip- 
ment, would suffer from this disadvantage to an even greater extent 

35 
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for a mobile equipment, whose weight is always critical, particularly 
if it is required to ascend a walkway staircase in order to intervene 
in a nuclear power station following a possible technical incident. 
Apart from its direct effect, the weight of a shield also represents a 
5 problem which cannot be circumvented on examining the potential energy 
involved during an impact, fall or descent of a step. Thus, e.g. 
for a shield weighing one tonne, which was shown hereinbefore to be 
inadequate, if the mobile equipment suddenly descends a 10 cm step and 
the corresponding energy mgh is absorbed by an elastic device of 

10 rigidity k, crushing 1 cm, it is possible to write: mgh = k Fx, where 

— 9 1 8 

F = kx, with x - 10 m and h = 10" m, then: F = 2. 10 N, which 

corresponds to an acceleration of 2.10 5 g. 

It is clear that the suspension of such a mass (control system and 
15 shield) placed on a moving equipment becomes an insoluble problem. 

Solution B, concerning the offset location of the electronics: 

By definition, it is in contradiction to the problem set, which con- 
20 sists of making a control system function under irradiation. 

Solution C, using equipment able to withstand radiation and 
commercially available : 

25 By definition, it is contrary to the set problem, which consists of 

making a true control system operate under irradiation, whereas comm- 
ercially available systems are much too rudimentary to satisfy the set 
problem. 

30 Solution D, aiming at designing a hardened control system: 

Hardening essentially consists of replacing M0S circuits with their 
equivalents, when they exist, in hardened technology (SOS, SOI, DMILL, 
etc.). However, the SOS, SOI and DMILL technologies are not widely 

35 
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commercially used, so that there is only a limited range of available 
components, both with regards to diversity of products and with 
regards to performance characteristics. For example in the case of 
microcontrollers, the presently available hardened products have 

5 functionalities and performance characteristics corresponding to a 
technological time lag of roughly 20 years compared . with unhardened 
products. They have no random access memory and their functionality 
and instruction sets are difficultly compatible with a control system 
of the type defined hereinbefore. Their irradiation resistance is 

10 approximately 300 kRad, namely an improvement by a factor of approx- 
imately 10 compared with a standard component and a little higher 
compared with a particularly vulnerable model. However, DMILL tech- 
nology admittedly makes it possible to reach 10 MRad. However, it 
does not make it possible to implement rewritable memories. In addi- 

15 tion, the commercial availability is extremely limited and, for its 

implementation, requires the development of ASICs, which imposes con- 
straints incompatible in practice with the implementation of a mobile 
robot control. 

20 Hardening of the electronics becomes increasingly difficult when the 
irradiation dose to be withstood increases. Moreover, as shown by 
document [5], on passing a threshold of approximately 1 kRad (low 
conventional electronics limit under irradiation), the cost of harden- 
ing increases with the dose rate in proportions not making it possible 

25 to reach or exceed 1 MRad. 

To conclude, existing control systems only offer rudimentary functions, 
performed at low speed, without any possibility of significantly 
improving their performance characteristics or reliability. The 
30 acquisition rate for information from sensors is so low that it pre- 
vents any force return possibility, which would be indispensable for 
the performance of certain teleoperation tasks. 

The autonomy level given by such controls is very low and really 

35 
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teleoperated systems are involved. However, nuclear applications 
cannot make do with teleoperation. A radiocontrolled machine must 
e.g. be able to take an autonomous decision in the case of a trans- 
mission problem (e.g. return to the position preceding communication 
loss). Another well known example consists of introducing via a lock 
a mobile robot into a nuclear power station following an incident 
which has led to a leak of nuclear material within the building. It 
is known how a robot can be introduced, but the respecting of the 
necessary sealing prevents transmitting controls to it by cable. Thus, 
it is vital that the robot can move autonomously to one of these 
points, which cannot be achieved at present. 



This prior art can be summarized on the basis of the recent design 
project for a Pioneer mobile robot for intervention on the Chernobyl 
15 site. The specification required the withstanding of a cumulative 

dose of 1 MRad. No industry or research laboratory was able to pro- 
pose a carried control system complying with this requirement. In the 
device at present being studied, all the directives are supplied wire- 
to-wire to an offset control station. 



The present invention relates to an electronic system operating under 
irradiation, particularly X or gamma radiation, a process for design- 
ing such a system and its preferred application to a control system 
of a mobile robot operating under said irradiation. 

DESCRIPTION OF THE INVENTION 



The present invention relates to a process for designing electronic 
systems able to operate under irradiation and comprising the following 
30 stages: 

I. Enumerating all the functions to be implemented by the system; 

II. determining the electronic components able to physically 
implement these functions, whilst giving preference to models 

35 
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having the larger scale integration; 

III. determining the volume of components which can be protected by 
protection means referred to as shielding, whilst taking account 
of the radiation dose to be withstood by the system, the maximum 

5 permitted weight of the material chosen for said shielding, as 

well as the distance at which components selectively protected 
by said shielding could be from other, unshielded components; 

IV. establishing a list of the most vulnerable components, whilst 
firstly taking account of their technology, then their degree 

10 of integration, whilst associating with each of these components 

the components which have to be installed in their immediate 
vicinity, if existing, and whilst firstly positioning the most 
vulnerable component, then that whose vulnerability is slightly 
less high and so on, optionally placing several identical 

15 vulnerability circuits; 

V. selecting on the basis of the list of the preceding stage, a 
group of components, commencing with the most vulnerable com- 
ponents and limiting said group to components which, by their 
very dimensions, can be installed in the volume defined in 

20 stage III: 

VI. examining whether the components in said system can implement 
coherent functions and only communicate with the remainder of 
the system by a reasonable number of wires, which transmit 
signals able to pass through without deterioration the distance 

25 stipulated in stage III between the selectively protected com- 

ponents and the other components; if all these conditions are 
not simultaneously fulfilled, modifying by iteration the list 
of components in order to obtain this result, but without 
exceeding the volume defined in stage III; if all these con- 

30 ditions are simultaneously fulfilled pass to the following stage, 

the group of components obtained in this way being called the 
"first group of first components" and the other components being 
called the "second group of second components"; 

VII. designing the physical installation of the first group of first 

35 

B 13154.3 DB 



- 10 - 



components, designing the shielding, constituted by at least 
one radiation-absorbing material, positioned around said first 
group of components, and designing between the first group of 
components and the second, connection means arranged so as not 
5 to form a penetration path for ambient radiation; 

VIII. designing the physical installation of the second group of 
components, evaluating the radiation dose which they have to 
withstand and, if necessary, using a complimentary procedure 
for improving their suitability for operating under irradiation 

10 by a technique other than shielding; 

IX. evaluating whether the solution to the problem set is or is not 
obtained: if it is not obtained, modifying the parameters of 
stage III (weight and nature of the shielding material, maximum 
acceptable irradiation dose, distance between the first group 

15 of components and the second) and repeating the procedure as 

from stage III; if it is obtained consider that the purely 
designed part is completed in a satisfactory manner and option- 
ally start the experimental part of stage X; 

X. validate the design by producing a prototype in accordance with 
20 the above design stages, at least with regards to the first 

group of components, put into place in the protection means 
(shielding thereof) and carry out irradiation tests; if said 
tests are not in accordance with the specifications, modify the 
parameters of stage III (weight and nature of the shielding 
25 material or optionally the maximum acceptable irradiation dose) 

and repeat the procedure as from stage III, stage X being 
optional • 

It does not pass outside the scope of the present invention to perform 
30 certain stages implicitly and in a more or less simultaneous manner, 
but in fact fulfilling the same function. This is particularly the 
case with stages IV, V and VI which a skilled person can carry out 
"at his discretion" without necessarily breaking down his work into 
elementary steps, as has been done here for clarity reasons. It also 

35 



B 13154.3 DB 




- 11 - 

does not involve passing outside the scope of the invention not to 
perform stage X. 

Stage II, which leads to preferably choosing operationally very rich 
5 circuits, has the consequence of limiting the functionalities to be 
ensured by the other components of the system. This facilitates 
recourse to techniques other than shielding for ensuring their pro- 
tection. 

10 Stage III involves the parameters concerning the dimensioning of the 
protection. The actual shielding or shield is implemented in accord- 
ance with the prior art, particularly with regards to the material, 
which must be adapted to the nature of the considered radiation. 

15 Stage IV mentions a list of the most vulnerable components, whilst 

taking account of their technology and then their degree of integra- 
tion. A skilled person or a person making use of information from the 
designer can draw up a first hierarchy in the aptitude of the com- 
ponents to withstand a certain radiation dose. However, operating in 

20 a stringent manner and taking account of behavioural differences of 
the circuits as a function of the energy of the radiation, the 
intensity thereof and the distribution thereof in time, it is partic- 
ularly advantageous to perform tests. 

25 Stage V defines components which are to be selectively protected, 

namely high performance and function-rich components for which it is 
impossible to find in conventional industrial ranges radiation- 
resistant equivalents. The standard example is a VLSI CMOS technology 
microcontroller having on a single semiconductor chip a central pro- 

30 cessing unit, memories, inputs/outputs, watchdog, etc. Of the list 

of the preceding paragraph only those components are retained, start- 
ing with the most vulnerable, which can be installed in the volume 
defined in paragraph III. Components which have to be physically very 
close to these components, such as the watch quartz of a micro- 

35 
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controller or bypass capacitor or capacitors, are associated therewith 
and are a priori retained in the same way. However, it does not pass 
outside the scope of the invention to decide not to protect these 
auxiliary components. 



If it is vital to protect more components than the shield can contain, 
two other possibilities exist which can be implemented in accordance 
with the invention: 

combining these components by implantation or "hybridization" 
10 (compact fitting of electronic chips) in order to protect them by a 
single shield, 

allocating to the radiation protection several shields containing 
selectively protected components. 

15 Difficulties can arise in removing the heat generated by the operation 
of these components. In this case, it does not pass outside the scope 
of the invention to incorporate between said components and the shield 
an electrically insulating, but thermally conductive product in order 
to remove the heat through the shield. 

20 

Stage VI constitutes a validation of the components selected in the 
preceding stage, whilst envisaging the constraints linked with the 
operation of the electronics, particularly the number and passband of 
the signals which flow between the components to be selectively pro- 
25 tected by shielding and those which are not protected. Nevertheless, 
the aim for said second components is to improve their tolerance to 
radiation by any procedure other than shielding (see stage VIII). 

Stage VII involves the production of protection means or shielding. A 
30 preferred implementation of the shield is constituted by two half- 
shells joined together by screws arranged in such a way as to minimize 
the effect thereof on the protection of the components. The connec- 
tions with the second group of components can advantageously take 
place by a flexible printed circuit, which follows a baffle equipping 



5 
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the shield at its input/output, in order to avoid radiation penetra- 
tion. 

In an advantageous embodiment said shield is connected to the 
remainder of the system: 

mechanically by a cushioning suspension, 
- electrically by connections which are sufficiently flexible to 

take account of the displacements due to this mechanical suspension. 

Stage VIII refers to protection methods other than shielding, e.g. 
processes for managing the operation of these components by redun- 
dancies and/or optimization of supply voltages as described in docu- 
ments [1] and [2], making it possible to significantly extend their 
life. Another example is the use of action concatenation timing 
diagrams (particularly with respect to the logic system), whose time 
ranges are sufficiently wide to make their operation tolerant with 
respect to time drifts which can be caused by irradiation. 

BRIEF DESCRIPTION OF THE DRAWINGS 

Fig. 1 is a flowchart of the different stages of the process according 
to the invention. 

Fig. 2 diagrammatically shows the electronic system of the invention. 

Fig. 3 is a block diagram of the interface shown in fig. 2, which in 
the described case has several electronic cards installed in a 
bay. 

Figs. 4A and AB show an installation of the group of first components. 

Figs. 5A and 5B show two sectional views of the shield, revealing the 
group of first components illustrated in figs. AA and AB. 
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Fig. 6 diagrammatically shows the information exchanges between the 
components selectively protected in the shield 22 and the 
remainder of the system, via interface cards 33 and 37 . 

5 Figs, 7A and 7B illustrate a mechanical embodiment of the invention, 
fig, 7A showing the general arrangement and fig. 7B a mechan- 
ical installation of a shock absorber and/or vibration absorber 
for the shielded part. 

10 Fig. 8 places the control system according to the invention in the 
overall context of its use. 

DETAILED DESCRIPTION OF A SPECIAL EMBODIMENT 

15 In the remainder of the description consideration will be given in 
exemplified manner to a preferred application of the invention con- 
stituted by a control system for a mobile robot able to operate in an 
irradiated medium and having to withstand 1 MRad. 

20 The application of the process of the invention described hereinafter 
takes place in accordance with the flowchart of fig. 1, which reveals 
the different stages of the design process. If at the end of a first 
iteration said process leads to a result incompatible with the 
initial parameters, a second iteration is undertaken following modifi- 

25 cation of said parametrs. 



First iteration 

Stage I - Functions of the control system 



30 The list of functions to be implemented for the envisaged control 
comprises the five following families : 

acquisition of sensor measurements and analog or digital processing, 
e.g. 

six analog motor current measurements, 
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two analog temperature measurements, 

one analog battery current measurement, 

one analog voltage reference measurement, 

ten relay control conformity discreet inputs, 
5 five miscellaneous discreet inputs; 

dispatch of controls, e.g.: 

six analog motor controls, 

ten relay control discreet outputs, 

five auxiliary discreet outputs; 
10 - communication via a "full duplex" series link with the control 
station: 

interpretation of the messages received, 
transmission of messages, 
checking the conformity of the messages; 
15 - checking the operation of the robot: 
checking the actions of the robot, 

interruption of the measurement of the safety sensors, 
management of the safety modes (thermal, on motor current, 
measurement drifts) ; 
20 - degraded or autonomous mode management (communication loss, 
autonomous actions , etc . ) . 

Stage II - Electronic components of the system 

25 The functional analysis of the robot controller leads to investigating 
components incorporating: 

- drivers, address decoding, three-state logic, 

- analog/digital converter, analog filters, analog amplifiers, 

- digital/analog converters, 

30 - discreet logic components, relays. 

The choice of the electronic components is oriented towards components 
having the maximum degree of integration, namely: 

a controller 40 (incorporating the processor, a code memory, a 

35 
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random access memory (RAM), a universal asynchronous receiver trans- 
mitter ( U ART ) circuit, a bus manager, a watchdog and high calculating 
speed performance characteristics, 

- an analog/digital converter 43 (including voltage reference, sample 
5 and hold circuit, logic operating in a three-state mode, control sig- 
nals, high performance characteristics as regards acquisition time and 
resolution) , 

operational amplifiers (filtering and amplification), 
digital/analog converters including a voltage reference, 
10 - TTL logic components (drivers, address decoding, three- 
state logic, discreet logic components) of the ALS type, 

- passive components, 
electromechanical relays. 

15 The microcontroller and analog/digital converter are in low consump- 
tion, low noise CMOS technology, but this renders them very radiation- 
fragile. These two components have no insensitive or relatively 
radiation-insensitive equivalent. As far as possible for other com- 
ponents use is made of bipolar or JFET technology components able to 

20 withstand gamma radiation. 

The procedure proposed in the process according to the invention runs 
counter to that of the expert who would use relatively unsophisticated 
preferably hardened components. According to the invention very 

25 radiation-sensitive functions are carried out (linked with the pro- 
cessor and its peripherals), which do not exist in MOS technology. 
At best the expert would use hardened technology components (SOI, SOS) 
for performing these functions. However, there is no industrial, hard 
ened microcontroller having an integration level equivalent to those 

30 of conventional CMOS technologies.-.and which could fulfil all these 
functions. There would then be several consequences: 

the acceptable dose level remains below 300 kRad for most hardened 
components (imposed by the needs of the space market, without any 
interest in the nuclear field), which amounts to saying that the set 
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problem could not be solved; 

even with a life not exceeding one third of the specified life, 
the general performance characteristics of the system would be lower 
by several orders of magnitude, i.e. ten to more than one hundred 
5 times as a function of the considered parameter, namely the processor 
calculating power, memory size, series link flow rate, processor cycle 
time and bus speed. 

Stage III - Determination of the available volume 

10 

The following parameters apply for determining the useful volume: 
the maximum permitted weight for the shield, e.g. 10 kg; 
the material, e.g. for the considered gamma radiation Denal would 
be chosen, this being a tungsten alloy; in stage III lead and Denal 
15 are envisaged in order to show the interest of Denal compared with 

lead, but iteration only takes place with lead in order not to over- 
burden the description; 

the acceptable radiation dose, e.g. 1 MRad, 

the distance between the two groups of components, e.g. less than 
20 2 dm. 

It can be deduced from this that it is possible to protect a volume 
limited to: 

(1 = 20 mm) x (L = 20 mm) x (h = 10 mm). 

25 

Stage IV - Classification of the components by vulnerability 

Theoretical knowledge enriched by experience has led to the following 
list: 

30 - analog/digital converter, 20 kRad, 

microcontroller: approximately 50 kRad, 
digital/analog converter: >1 MRad, 
operational amplifier: >1 MRad, 
- TTL logic components: >1 MRad whilst respecting the operating 
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rules (cf. stage VIII), 

passive components: approximately 100 MRad, 
relays: >1 MRad. 

5 Stage V - Components to be protected 

The microcontroller and analog/digital converters must be protected. 
To these components should be added as auxiliary elements to be 
installed in their vicinity, a watch quartz and bypass capacitors. 

10 

Stage VI - "First components" compatible with the volume given 

The available volume for the protection is not adequate to house the 
microcontroller and analog/digital converters, even when using 
15 hybridization methods. 

The process recommences at stage II. 

Second iteration 
20 Stage II - Electronic components of the system 

The number of analog/digital converters is limited to a single com- 
ponent and introduction takes place of an analog multiplexer and a 
selection logic making it possible to increase the number of analog 
25 acquisition channels. This choice is made to the detriment of the 

total acquisition time of the measurements, but can be compensated by 
a masked time software acquisition mechanism. 

The new list of electronic components is as follows: 
30 - a Siemens microcontroller, 
a digital/analog converter, 
an Analog Devices analog multiplexer, 

operational amplifiers (filtering and amplification), 
six digital/analog converters, 

35 
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TTL technology logic components (drivers, address decoding, three- 
state logic, discreet logic components, selection logic), 
pas si ve component s , 
electromechanical relays. 



Stage III - Determination of the available volume 

The result is identical to that of the preceding iteration, namely: 
(1 = 20 mm) x (L = 20 mm) x (h = 10 mm). 



Stage IV - Classification of the components by vulnerability 

microcontroller, approximately 50 kRad, 
analog/digital converter: 20 kRad, 
15 - analog multiplexer: >1 MRad, 

- digital/analog converter: >1 MRad, 
operational amplifier: >1 MRad, 

TTL logic components: >1 MRad whilst respecting the operating 



20 - passive components: approximately 100 MRad, 
relays: >1 MRad. 

Stage V - Components to be protected 

25 A microcontroller and an analog/digital converter, both encapsulated 

in accordance with CMS technology, i.e. components for surface instal- 
lation have associated with them as auxiliary elements a quartz and 
bypass capacitors. The multiplexer is not included in the protected 
components. 

30 

Stage VI - "First components' 1 compatible with the volume given 

Both the microcontroller and the analog converter are placed on a 
multilayer printed circuit. Each of these printed circuits is connec- 

35 
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ted to unshielded components by a flexible printed circuit, whose 
other end is an interface card of an electronic bay. 

The signals flowing in the flexible printed circuits are: 
5 - supplies, 

a multiplexed bus for the microcontroller (0-5V, 20 MHz), 

the control signals and data for the converter '(0-5V, 20 MHz), 

the analog input signal of the converter (+/- 10 V, 300 Hz, max). 

10 The passband and measurement sensitivity permit a displacement of a 
few decimetres of the first components with respect to the second 
components . 

The shield is formed form two Denal half-shells, together weighing 10 
15 kg and whose external shape is similar to that of a flattened sphere. 
The size of the shield is decided whilst establishing the relationship 
between the dose to be expected (1 MRad) and the resistance under 
irradiation of the most vulnerable component. The relationship for 
the control system is a protection factor 50. It is known that 35 mm 
20 of lead supply an attenuation factor of 10 for a cobalt 60 irradiation. 
The same result is obtained with 24 mm of D^nal. Use is made of a 
quasi-spherical shield weighing 10 kg and a lead radius of 60 mm and a 
Denal radius of 42 mm. The latter value makes it possible to guaran- 
tee the resistance of the first components to irradiation with a good 
25 safety margin. 

Stage VII - Implementation of the protected group 

The first group of first components is installed on two multilayer 
30 printed circuits, but the use of a single printed circuit would not 
fall outside the scope of the invention. Each of these two printed 
circuits communicates with an interface card belonging to the second 
group of components. 
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Stage VIII - Implementation of the unprotected group electronics 

This stage uses other procedures for guaranteeing the resistance under 
irradiation of the unprotected electronics, including: 
5 - action concatenation timing diagrams (at the TTL logic) which are 
tolerant to time drifts, 

- a dynamic operation of the three-state TTL logic managed by the 
microcontroller in order to minimize the leakage current in the 
blocked phase, 

10 - a software compensation of the drift under irradiation of the 
measurement of the analog/digital converter by measuring known 
reference voltages. 

Stage IX - System conformity 

15 

The calculations of stage VI and experience concerning the implement- 
ation of the complimentary procedures mentioned in stage VIII make it 
possible to prove that the system is able to satisfy specifications. 

20 Stage X - Validation test 

The validation tests under irradiation are firstly performed on the 
first group of first components, equipped with the shielding. This is 
followed by a test under irradiation of the complete system making it 
25 possible to prove the conformity of the complete system. 

At the end of the different stages of the process according to the 
invention illustrated on the flowchart of fig. 1, the electronic 
system described hereinafter is e.g. obtained. It is assumed herein- 
30 after that it is a mobile robot control system described as a pre- 
ferred embodiment. 

Fig. 2 illustrates the general architecture of an electronic system 10, 
which is constituted: 
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by an interface system 20 (with several cards), equipped with 
resistant or hardened or tolerant components, 

by a module 21 having standard industrial components protected by a 
shield 22 and connected to the interface system 20 by a flexible 
5 printed circuit 23, 25, 

by a data series transmission line 15, 

by connections with the robot 11 (controls of motors, information 
return, sensors), 

a power supply line 16. 

10 

Fig, 3 illustrates the system 20 showing the various electronic inter- 
face cards respectively having discreet inputs 31, discreet outputs 32, 
analog inputs 33 (connected to the flexible printed circuit 25), 
analog outputs 34, the interface 35 (connected to a data series trans- 

15 mission line 15) and bus processor management interface card 37 

(connected to the flexible printed circuit 23), as well as double line 
arrows 38 representing the information flow between these various 
cards. It also shows the power supply card 36 supplying the necessary 
voltages to the interfaces 31, 32, 33, 34, 35 and 37, as well as to 

20 the module 21 via the flexible printed circuits 23 and 25. 

Fig. 4A shows a microcontroller 40, a quartz 41 and a bypass 
capacitor 42, installed on a printed circuit 24 and connected by a 
flexible printed circuit 23 to the interface card 33 illustrated in 
25 fig. 3. The watch quartz 41 and supply bypass capacitor 42 must be 
connected as close as possible to the microcontroller 40. 

Fig. 4B shows an analog/digital converter 43, a bypass capacitor 44 
and an external voltage reference 45, installed on a printed circuit 
30 26 and connected by a flexible printed circuit 25 to the interface 

card 37 illustrated in fig. 3. The voltage reference circuit 45 and 
supply bypass capacitor 44 must be connected as close as possible to 
the analog/digital converter 43. 
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Figs. 5A and 5B show an example of the implementation of the shield 22 
constituted by two half-shells 50 and 51 ensuring the protection of 
the components AO, 41, 42, 43, 44, 45, These two half-shells con- 
stitute a shield, which it is aimed here to make isotropic in order 
5 to attenuate gamma rays. The passage of the flexible printed circuits 
23 and 25, input/output of the shield, has a baffle 52 preventing the 
radiation from directly reaching said components. Fig. 5B is a 
diagrammatic plan view of the two half-shells 50, 51, secured to one 
another by screws 53, 54. 

10 

Fig. 6 operationally illustrates the information exchanges between the 
components selectively protected in the shield 22 and the remainder of 
the system, via the interface cards 33, 37. 

15 The microcontroller 40 and analog/digital converter 43 are installed 
on the specific printed circuits 24 and 26. They are connected to 
interfaces belonging to the second group of components by flexible 
printed circuits 23 and 25 carrying: 
supplies 63, 

20 - address and data buses 64 of the microcontroller 40, 
- control and data signals 65 of the converter 43, 
the analog input signal 66 of the converter 43. 

A logic system, installed on the interface card 37, relays data, 
25 address and control signals in accordance with a conventional diagram, 
via a conventional processor bus 38 (motherboard). 

To said bus 38 is connected the data exchange and address decoding 
logic 70, which controls the selection logic of one input among N 
30 of an analog multiplexer 72 of the N:l type, connected to N analog 

inputs via preamplifiers/conditioners 73, all known to be resistant. 
Via the processor bus 38 and control logic 70, the microcontroller 
program 40 successively controls the conversion of analog input 
signals by successive selection thereof by means of the multiplexer 
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72 and then recovers the result of said analog/digital conversion via 
the same control logic 70 and processor bus 38. 

Figs. 7A and 7B show a mechanical embodiment of the invention. On a 
rack 90 in the form of a metal plate, is fixed a conventional frame 91 
constituting the physical support of the system 20 and having a 
motherboard 92, whose printed circuit carries the signals of the bus 
38, as well as analog lines acting on the conditioners 73 and supply 
lines from the card 36. To the motherboard 92 are connected the 
management interface cards 37 of the processor bus, the card 33 com- 
prising the analog multiplexing means 70 to 73 and the other cards 31, 
32, 34, 35, 36 not shown in the drawing. The cards 95 are not shown, 
motor control cards. 

The shield 22 is formed by a tight of hollowed out, Denal sphere 100 
constituted by two half-shells 50 and 51 from which emerge flexible 
printed circuits 23, 25 connected to cards 33, 37. This sphere 100 
is held by two elastomer cores 98, joined by a hollowed out plate 96 
and four small columns 97. The selected elastomer is polyurethane. 

Thus, the sphere 100 is placed on a first elastomer core 98, whose 
internal radius is chosen in such a way that it does not come into 
contact with the bearing or support plane of said first core 98, even 
with maximum crushing. A second identical core 98 is placed above the 
sphere 100. These two cores ensure the suspension mainly along the 
vertical axis. In order to also ensure the suspension in the two 
other orthogonal directions, two other sets of cores can be added 
along these axes. 

This absorber system maintains the assembly on the rack 90, whilst 
ensuring the damping of the movements of the sphere 100 in the case of 
an impact (e.g. in the case of dropping) or vibrations in the direc- 
tion perpendicular to the plane of the rack 90. 
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Thus, this construction ensures, within predetermined acceleration 
limits, that the mass of the sphere does not transmit to the rack 90 
and to the frame forces endangering the mechanical integrity of the 
assembly. 

Fig. 8 places the control system according to the invention in the 
overall context of its use for controlling a mobile robot or a tele- 
operation device. The diagram represents a complete control system, 
subdivided into two assemblies: 

a unit 10 located in the immediate vicinity of the robot 11 and 
exposed to the radiation flux (irradiated environment 12), 

a computer 13 in contact with the operator 14 and located in a 
non-hostile environment. 

Said unit 10 and said computer 13 are interconnected by a rapid, data 
transmission link 15. 

Unit 10 cyclically ensures: 

scanning the different sensors of the robot (position, speed, force 
return) , 

the dispatch of data from the sensors to the computer 13, 
the reception of directives calculated by the computer 13, 
the transmission for the implementation of these directives to the 
electronic power modules connected to the robot actuators (motors). 

In addition, reflex actions are expected of the unit 10, such as 
emergency stoppage in the case of abnormalities, such as excess curr- 
ent consumed by a motor, or degraded or autonomous operating modes. 
The implementation of such functionalities, which are known to the 
expert, does not form part of the invention. 

In more general terms, the invention is applicable to any electronic 
system having to operate under irradiation. Other than controls, 
these systems can include intelligent sensors or remote transmission 
systems. 
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